(01) The brief
The university issues reports and certificates that third parties need to validate. The goal: anyone with the number can check the document is authentic, and nobody can enumerate or guess someone else’s.
(02) What it does
- Public lookup by number or by scanning the QR printed on the document.
- Download of the original PDF only if the number exists.
- A private panel to upload documents and get each one’s number.
(03) How it was built
- Numbers generated on the server with cryptographic randomness and a huge search space: guessing at random gets you nowhere.
- Convex backend with typed functions; files live in private storage and are served through a temporary URL.
- Administrator sessions with expiry and a log of access attempts.
(04) Security
- Login attempts logged and rate-limited by time window.
- No public listing: the only way to reach a document is to have its number.
- Strict headers and a panel kept out of search engines.
(05) Speed and Google
Lightweight application with Vite; the lookup answers in under a second.
(06) What it deliberately doesn’t do
- It does not digitally sign the PDFs; it verifies their existence and serves the original.
